# What is a Man-in-the-Middle (MITM) Attack?

> A man-in-the-middle (MITM) attack is an active communications attack in which an adversary interposes between two parties, relays their exchanges, and may read, alter, inject, delay, or block data while each party believes it is communicating directly with the other.

- Canonical URL: https://yellowcube.eu/glossary/man-in-the-middle-attack/
- Publisher: Yellow Cube
- Language: en
- Contact: hello@yellowcube.eu

## Content

Contemporary technical writing also uses “on-path attacker” as a more descriptive term.

An adversary may gain this position through compromised network infrastructure, traffic redirection, name- or address-resolution manipulation, a deceptive access point, an unauthorized proxy, or interference with connection establishment. Effective protection combines peer authentication, message integrity, and confidentiality, with correct certificate or key validation and secure failure behavior.

### Key points

- **Possible effects:** The intermediary may capture secrets, substitute content, alter transactions, downgrade protection, redirect a session, or impersonate each endpoint to the other.
- **Evidence:** Unexpected certificate or key changes, altered resolution or routing, duplicate sessions, and protocol downgrades may justify investigation but are not conclusive alone.
- **Defensive priorities:** Use authenticated encryption, validate peer identities and trust chains, secure naming and local networks, remove obsolete fallbacks, and monitor route, certificate, and proxy changes.
- **Important limitation:** Encryption without reliable peer authentication can still leave a connection open to an active intermediary. Correctly configured transport protection also cannot prevent an already compromised endpoint or trusted intermediary from accessing plaintext available there.

### Related terms

[Eavesdropping attack](<https://yellowcube.eu/glossary/eavesdropping-attack/>) · [Encryption](<https://yellowcube.eu/glossary/encryption/>) · [Authentication](<https://yellowcube.eu/glossary/authentication/>) · [Address Resolution Protocol (ARP)](<https://yellowcube.eu/glossary/address-resolution-protocol/>) · [Public key infrastructure (PKI)](<https://yellowcube.eu/glossary/public-key-infrastructure/>)

### Sources

[RFC 4949 (Informational): Internet Security Glossary, Version 2](https://www.rfc-editor.org/rfc/rfc4949.html) · [IETF RFC 7435 (Informational): Opportunistic Security: Some Protection Most of the Time](https://www.rfc-editor.org/rfc/rfc7435.html) · [IETF RFC 9846: The Transport Layer Security Protocol Version 1.3](https://www.rfc-editor.org/rfc/rfc9846.html)

## Attribution and scope

This Markdown representation is generated from the same approved content records as the canonical HTML page. Cite the canonical URL above when referencing this material. Product and service descriptions are informational; confirm project-specific requirements with Yellow Cube.